CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18488 – Backup Guard <= 1.1.46 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18488
The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues. El complemento Backup Guard versión anterior a 1.1.47 para WordPress tiene múltiples problemas XSS. • https://wordpress.org/plugins/backup/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1002016 – flickr-picture-backup <= 0.7 - Arbitrary file upload
https://notcve.org/view.php?id=CVE-2017-1002016
Vulnerability in wordpress plugin flickr-picture-backup v0.7, The code in flickr-picture-download.php doesn't check to see if the user is authenticated or that they have permission to upload files. Existe una vulnerabilidad en el plugin flickr-picture-backup v0.7 de WordPress. El código en flickr-picture-download.php no verifica si el usuario está autenticado o tiene permisos para subir archivos. • http://www.vapidlabs.com/advisory.php?v=190 https://wordpress.org/plugins/flickr-picture-backup • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9310 – WordPress Backup to Dropbox < 4.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-9310
Cross-site scripting (XSS) vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress. Vulnerabilidad de tipo Cross-site scripting (XSS) en el plugin WordPress Backup to Dropbox, en versiones anteriores a la 4.1. • http://www.securityfocus.com/bid/75082 https://security.szurek.pl/wordpress-backup-to-dropbox-40-reflected-xss.html https://wordpress.org/plugins/wordpress-backup-to-dropbox • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 11%CPEs: 1EXPL: 3CVE-2014-9119 – DB Backup < 5.0 - Directory Traversal
https://notcve.org/view.php?id=CVE-2014-9119
Directory traversal vulnerability in download.php in the DB Backup plugin 4.5 and earlier for Wordpress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. Vulnerabilidad de salto de directorio en download.php en el plugin DB Backup 4.5 y anteriores para Wordpress permite a atacantes remotos leer ficheros arbitrarios a través de un .. (punto punto) en el parámetro file. • https://www.exploit-db.com/exploits/35378 http://seclists.org/oss-sec/2014/q4/1059 https://exchange.xforce.ibmcloud.com/vulnerabilities/99368 https://wpvulndb.com/vulnerabilities/7726 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2014-10076 – Database Backup for WordPress <= 2.2.4 - Missing Authorization
https://notcve.org/view.php?id=CVE-2014-10076
The wp-db-backup plugin 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack. El plugin wp-db-backup 2.2.4 para WordPress se basa en una cadena de cinco caracteres para el control de acceso, lo que facilita a los atacantes remotos la lectura de archivos de copia de seguridad mediante un ataque por fuerza bruta. The wp-db-backup plugin up to 2.2.4 for WordPress relies on a five-character string for access control, which makes it easier for remote attackers to read backup archives via a brute-force attack. • http://www.vapidlabs.com/advisory.php?v=81 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-862: Missing Authorization •